Re: [Qemu-devel] [PATCH 1/2] qdev: factor out qdev_print_devinfo.

[Gerd Hoffmann <kraxel@redhat.com>]

On 08/01/09 01:44, Markus Armbruster wrote:
> Gerd Hoffmann<kraxel@redhat.com>  writes:
>
>> Signed-off-by: Gerd Hoffmann<kraxel@redhat.com>
>> ---
>>   hw/qdev.c |   19 ++++++++++++++++++-
>>   1 files changed, 18 insertions(+), 1 deletions(-)
>>
>> diff --git a/hw/qdev.c b/hw/qdev.c
>> index 479eb72..6f05232 100644
>> --- a/hw/qdev.c
>> +++ b/hw/qdev.c
>> @@ -105,6 +105,21 @@ DeviceState *qdev_create(BusState *bus, const char *name)
>>       return dev;
>>   }
>>
>> +static int qdev_print_devinfo(DeviceInfo *info, char *dest, int len)
>> +{
>> +    int pos = 0;
>> +
>> +    pos += snprintf(dest+pos, len-pos, "name \"%s\", bus %s",
>> +                    info->name, info->bus_info->name);
>> +    if (info->alias)
>> +        pos += snprintf(dest+pos, len-pos, ", alias \"%s\"", info->alias);
>> +    if (info->desc)
>> +        pos += snprintf(dest+pos, len-pos, ", desc \"%s\"", info->desc);
>> +    if (info->no_user)
>> +        pos += snprintf(dest+pos, len-pos, ", no-user");
>> +    return pos;
>> +}
>> +
>
> Isn't len-pos vulnerable to underflow here?  The formal parameter type
> is size_t...
>
> [...]

Huh?  You mean you want be able to pass a buffer larger than 2^31 to 
that function?

cheers
   Gerd